CVE-2026-102810 — Marmite through 0.4.2 Path Traversal via Development Server
Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The han…
Published: 2026-09-29 · CVSS: 8.7 · CVSS 4.0
Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handle_request function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to the output folder, enabling attackers to request encoded traversal sequences to access files readable by the marmite process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7